generic: check CAP_LINUX_IMMUTABLE capability

It should return error while changing IMMUTABLE_FL and APPEND_FL if the
process has no capability CAP_LINUX_IMMUTABLE.

However, it's not true on overlayfs after kernel version v4.19 since
the process's subjective cred is overridden with ofs->creator_cred
before calling real vfs_ioctl.

The following patch for ovl fix the problem:
  "ovl: check the capability before cred overridden"

Add this testcase to cover this bug.

Signed-off-by: Jiufei Xue <jiufei.xue@linux.alibaba.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
This commit is contained in:
Jiufei Xue
2019-05-08 15:10:00 +08:00
committed by Eryu Guan
parent 9820d643ea
commit 80bac2129b
4 changed files with 85 additions and 0 deletions
+1
View File
@@ -547,3 +547,4 @@
542 auto quick clone
543 auto quick clone
544 auto quick clone
545 auto quick cap